Back to Mail FAQs
HELP CENTER · FAQMail1 min read

How should I rotate a DKIM signing key?

DKIM key rotation replaces the public key published in DNS and the private key used to sign outgoing mail. Coordinate the signer and DNS changes so messages continue to verify while caches may still contain the previous public key.

IaGenify
Mail

Prepare the new selector

Create a new selector and key pair using the mail system’s supported process, then publish its public key in DNS before sending with it. Confirm the TXT record is complete and visible from authoritative DNS.

Allow for DNS propagation and caching according to the record TTL and provider behavior. Do not remove the old selector while messages signed with its key may still be in transit or reports are being investigated.

Switch signing and retire the old key

Configure the sending system to sign with the new selector and verify test messages at receiving systems. Check that the DKIM signature aligns with the intended domain and that the public key lookup succeeds.

After the transition window, remove the old DNS key and securely retire its private key according to your security procedure. Document selector ownership and the next review date.

Back to Mail FAQs